{"id":"CVE-2026-99188","kind":"vulnerability","aliases":["CVE-2026-99188"],"related":[],"title":"Linux kernel: stmmac RGMII status interrupt storm can lock up resume","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: dwmac1000: clear the RGMII status interrupt\n\nSince commit 2e2c878a3141 (\"net: stmmac: remove SGMII/RGMII/SMII\ninterrupt handling\") nothing on the RGMII path reads GMAC_RGSMIIIS, so\nRGSMIIIS stays pending behind GMAC_INT_MASK from the first link change\non. stmmac_resume() resets the MAC in stmmac_hw_setup(); the reset sets\nGMAC_INT_MASK to 0 until dwmac1000_core_init() writes the mask again,\nand the pending status storms the line:\n\n  dwmac_dma_interrupt: unexpected status 04000000\n\nA register dump at the first message on ODROID-HC4 showed it:\n\n  core int_status 00000001 int_mask 00000000 pmt 00000000 rgsmiiis 0000000d\n\nWhen the resume thread runs on the CPU that takes the MAC interrupt,\nthe storm starves it: a soft lockup, then a watchdog reset or a hang.\n\nRead GMAC_RGSMIIIS in dwmac1000_irq_status() when the status is not\nmasked, as the driver did before 2e2c878a3141; the read clears it.\n\nWake-on-LAN resume from s2idle with the resume thread and the MAC\ninterrupt on one CPU: Helios64 (dwmac-rk), 7.3-rc6, soft-locked in 3 of\n3 resumes without a fix and in 0 of 10 with this patch; it ran with an\nout-of-tree dwmac-rk change that keeps the GMAC powered across suspend.\nODROID-HC4 (dwmac-meson8b): 0 of 10 with this patch, 2 of 2 without a\nfix on a 7.3-rc5 build. irq_rgmii_n went up by one per resume.","summary":"In the Linux kernel's stmmac Ethernet driver for dwmac1000, a pending RGMII status bit is never cleared after a link change, so the MAC interrupt fires repeatedly. On resume from suspend this can starve the CPU and cause a soft lockup, watchdog reset or hang.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-boards","dwmac1000","linux-kernel","package","rgmii","stmmac","wake-on-lan"],"not_affected_if":["no-dwmac1000-mac","no-rgmii"],"how_to_check":"- Look for the kernel log message `dwmac_dma_interrupt: unexpected status 04000000` after resume.\n- Check whether the machine uses an stmmac dwmac1000 MAC, such as dwmac-rk or dwmac-meson8b, with RGMII.\n- Check the kernel version against the fixed release; sources do not name affected version ranges.","fix":"- Update the Linux kernel to a release that includes the commit clearing GMAC_RGSMIIIS in dwmac1000_irq_status(); the sources do not name the exact version.\n- Until patched, unknown mitigation from the sources.","status":"open","published_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:34:18+00:00","updated_at":"2026-10-28T11:34:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T11:34:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the commit clearing GMAC_RGSMIIIS in dwmac1000_irq_status(); the sources do not name the exact version.\n- Until patched, unknown mitigation from the sources.","reach":"local","title":"Linux kernel: stmmac RGMII status interrupt storm can lock up resume","impact":"low","summary":"In the Linux kernel's stmmac Ethernet driver for dwmac1000, a pending RGMII status bit is never cleared after a link change, so the MAC interrupt fires repeatedly. On resume from suspend this can starve the CPU and cause a soft lockup, watchdog reset or hang.","category":"package","nicknames":[],"who_cares":["linux-kernel","stmmac","dwmac1000","rgmii","arm-boards","wake-on-lan"],"confidence":0.6,"needs_auth":"no","worst_case":"Denial of service: soft lockup, watchdog reset or hang on resume","analyst_note":"Find the fixed kernel version and the commit that adds the GMAC_RGSMIIIS read in dwmac1000_irq_status(); sources give no affected version range.","how_to_check":"- Look for the kernel log message `dwmac_dma_interrupt: unexpected status 04000000` after resume.\n- Check whether the machine uses an stmmac dwmac1000 MAC, such as dwmac-rk or dwmac-meson8b, with RGMII.\n- Check the kernel version against the fixed release; sources do not name affected version ranges.","needs_analyst":true,"not_affected_if":["no-dwmac1000-mac","no-rgmii"],"who_is_affected":"Systems running a Linux kernel with the stmmac driver on a dwmac1000 MAC using RGMII, particularly boards that resume from s2idle with wake-on-LAN and where the resume thread shares a CPU with the MAC interrupt. Sources report examples on Helios64 (dwmac-rk) and ODROID-HC4 (dwmac-meson8b). Systems without these MACs or without this resume pattern are unlikely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000772,"input_tokens":3860,"output_tokens":772,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99188':14A,17A '0':144C,278C,309C '00000000':185C,187C '00000001':182C '0000000d':189C '04000000':165C '10':280C,311C '2':315C,317C '2e2':98C,235C '3':269C,271C '7.3':263C,323C 'across':301C 'arm':19B 'arm-board':18B 'behind':118C 'bit':46B 'board':20B 'build':325C 'c878a3141':99C,236C 'caus':70B 'chang':53B,126C,295C 'clear':49B,91C,239C 'commit':97C 'core':147C,179C 'cpu':68B,197C,258C 'cve':12A,15A 'dma':161C 'driver':39B,232C 'dump':168C 'dwmac':160C,261C,293C,307C 'dwmac-meson8b':306C 'dwmac-rk':260C,292C 'dwmac1000':21B,41B,90C,146C,221C 'ethernet':38B 'fire':58B 'first':124C,171C 'fix':275C,320C 'follow':83C 'gmac':112C,119C,140C,218C,299C 'handl':105C 'hang':77B,216C 'hc4':176C,305C 'helios64':259C 'hw':135C 'init':148C 'int':120C,141C,180C,183C 'interrupt':6A,57B,95C,104C,162C,202C,255C 'irq':222C,326C 'keep':297C 'kernel':2A,24B,35B,81C 'lan':31B,244C 'line':159C 'link':52B,125C 'linux':1A,23B,34B,80C 'linux-kernel':22B 'lock':9A,267C 'lockup':73B,209C 'mac':56B,132C,201C,254C 'mask':121C,142C,151C,184C,229C 'meson8b':308C 'messag':172C 'n':328C 'net':88C,100C 'never':48B 'noth':106C 'odroid':175C,304C 'odroid-hc4':174C,303C 'one':257C,332C 'out-of-tre':288C 'packag':25B 'patch':283C,314C 'path':110C 'pend':43B,117C,155C 'per':333C 'pmt':186C 'power':300C 'ran':285C 'rc5':324C 'rc6':264C 'read':111C,217C,238C 'regist':167C 'remov':102C 'repeat':59B 'reset':75B,130C,138C,213C 'resolv':87C 'resum':11A,61B,129C,192C,245C,250C,272C,334C 'rgmii':4A,26B,44B,93C,109C,327C 'rgsmiii':113C,115C,188C,219C 'rk':262C,294C 'run':194C 's2idle':247C 'set':139C 'setup':136C 'sgmii/rgmii/smii':103C 'show':177C 'sinc':96C 'soft':72B,208C,266C 'soft-lock':265C 'starv':66B,205C 'status':5A,45B,94C,156C,164C,181C,223C,226C 'stay':116C 'stmmac':3A,27B,37B,89C,101C,128C,134C 'storm':7A,157C,204C 'suspend':63B,302C 'take':199C 'thread':193C,251C 'tree':291C 'unexpect':163C 'vulner':84C 'wake':29B,242C 'wake-on-lan':28B,241C 'watchdog':74B,212C 'went':329C 'without':273C,318C 'write':149C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the stmmac driver on a dwmac1000 MAC using RGMII, particularly boards that resume from s2idle with wake-on-LAN and where the resume thread shares a CPU with the MAC interrupt. Sources report examples on Helios64 (dwmac-rk) and ODROID-HC4 (dwmac-meson8b). Systems without these MACs or without this resume pattern are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99188","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99188","severity":null,"published_at":"2026-10-28T11:17:39+00:00","modified_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}